Containerd vulnerabilities
29 CVEs and advisories name Containerd as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-47218runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox
- CVE-2026-95838containerd: Unpack DoS via repeated opaque whiteouts
- CVE-2026-95837containerd CRI plugin: Checkpoint restore bypasses destination security context
- CVE-2026-107446containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for
- CVE-2026-53493Containerd has image-pull DoS via crafted OCI index graph amplification
- CVE-2026-53495containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service
- CVE-2026-53489containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
- CVE-2026-53492containerd CRI checkpoint restore CDI annotation smuggling
- CVE-2026-50195containerd: CRI checkpoint import allows local image tag poisoning
- CVE-2026-47262containerd image-triggered runtime DoS via unbounded group parsing
- CVE-2026-46680containerd user ID handling bypass allows runAsNonRoot evasion
- CVE-2026-53488containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
- CVE-2025-64329containerd CRI server: Host memory exhaustion through Attach goroutine leak
- CVE-2024-25621containerd affected by a local privilege escalation via wide permissions on CRI directory
- CVE-2025-47291containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
- CVE-2025-47290Containerd vulnerable to host filesystem access during image unpack
- CVE-2024-40635containerd has an integer overflow in User ID handling
- CVE-2023-25173containerd supplementary groups are not set up properly
- CVE-2023-25153containerd OCI image importer memory exhaustion
- CVE-2022-23471containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak
- CVE-2022-31030containerd CRI plugin: Host memory exhaustion through ExecSync
- CVE-2022-24778Incorrect Authorization in imgcrypt
- CVE-2022-23648Insecure handling of image volumes in containerd CRI plugin
- CVE-2021-43816Improper Preservation of Permissions in containerd
- CVE-2021-41103Insufficiently restricted permissions on plugin directories
- CVE-2021-32760Archive package allows chmod of file outside of unpack target directory
- CVE-2021-21334environment variable leak
- CVE-2020-15257containerd-shim API Exposed to Host Network Containers
- CVE-2020-15157containerd can be coerced into leaking credentials during image pull